Novel scheme for secure data transmission based on mesoscopic twin beams and photon-number-resolving detectors

Quantum resources can improve the quality and security of data transmission. A novel communication protocol based on the use of mesoscopic twin-beam (TWB) states of light is proposed and discussed. The message sent by Alice to Bob is encoded in binary single-mode thermal states having two possible mean values, both smaller than the mean value of the TWB. Such thermal states are alternately superimposed to the portion of TWB sent to Bob. We demonstrate that in the presence of an eavesdropping attack that intercepts and substitutes part of the signal with a thermal noise, Bob can still successfully decrypt the message by evaluating the noise reduction factor for detected photons. The protocol opens new perspectives in the exploitation of quantum states of light for applications to Quantum Communication.

www.nature.com/scientificreports/ "Discussion" section is devoted to the possible eavesdropper's attacks and to the strategy used to reveal them. Finally, in the "Conclusions" we summarize our results and outline some future perspectives.

Results
The protocol step-by-step. As already anticipated in the "Introduction", Alice produces mesoscopic TWB states. We assume that such states are described as the tensor product of µ identical (i.e. equally populated) TWB states where 2 = �n k �/(1 + �n k �) and n k is the mean number of photons in the k-th mode 17,18 . The multi-mode TWB is described by the following density matrix where |n� = δ(n − µ k=1 n k ) µ k=1 |n k � k and n is the overall number of photons in the µ spatio-spectral modes that impinge on the detector, while P µ (n) is the multi-mode thermal distribution in which n is the mean number of photons in each arm. These states are entangled in the number of photons. To prove it, many nonclassicality criteria have been proposed during the past twenty years [19][20][21][22] . Some of them are necessary and sufficient, some are only sufficient, and some others only necessary 23 . In this work, we consider a nonclassicality criterion based on the noise reduction factor 24 , since it can be easily accessed from the experimental point of view 25 . We define the noise reduction factor as 26 where σ 2 (n 1 − n 2 ) is the variance of the distribution of the photon-number difference between the two parties, while �n 1 � + �n 2 � is the shot-noise-level, that is the variance of the distribution of the photon-number difference in the case of two coherent states having mean values n 1 and n 2 . It can be demonstrated that the condition R < 1 , meaning that signal and idler arms exhibit sub-shot-noise correlations, represents a sufficient condition for entanglement 23,24 . We have already shown that R can be also written in terms of measurable quantities, such as detected photons 17 , so that the nonclassicality condition can be directly applied to the experimental data In particular, for a multi-mode TWB state, �m 1 m 2 � = (1 + 1/µ)�m 1 ��m 2 � + √ η 1 η 2 √ �m 1 ��m 2 � , so that the noise reduction factor can be expressed as η j being the quantum efficiencies of the detectors and �m j � = η j �n j � the mean values of detected photons. The equation can be further simplified by assuming �m 1 � = �m� = η�n� , �m 2 � = t�m� = tη�n� , t ∈ [0, 1] being the transmission efficiency quantifying the balancing level Now, let us assume that Alice encodes a binary message in the portion of multi-mode TWB sent to Bob by adding a small noise signal. This is given by a single-mode thermal state with two possible mean values: the higher mean value m H corresponds to the logic bit 1, while the lower mean value m L to the logic bit 0. We can assume that m H is 3 or 4 times m L , and that they represent the 20% or the 7 % of the global light, respectively. As better remarked in the following, we choose to encode the message in a single-mode thermal state because the expression of R is particularly sensitive to the presence of added thermal noise 16 . The presence of this noise source modifies the statistics of light, which becomes the convolution between the multi-mode thermal distribution of the TWB and the single-mode thermal state with µ TH = 1 of the additional noise √ P(m)P theo (m) , where P(m) and P theo (m) are the experimental and theoretical distributions, respectively, and the sum is extended up to the maximum detected-photon number, m , above which the two distributions become negligible. This demonstrates that it is really hard to discriminate the presence or not of an additional thermal noise. Nevertheless, by comparing the statistics shown in the two panels, we notice that having access to the statistics of light could be sufficient to discriminate which signal was sent. However, this operation requires a proper data sample. If the sequence is too short, the reconstructed statistics is not reliable. Moreover, in the case of an eavesdropping attack, in which part of the sent signal is intercepted and additional noise is added, the reconstruction of the statistics can no longer be used to discriminate which light signal has been sent. On the contrary, evaluating the level of nonclassicality can help since both loss and noise sources can be incorporated in the model for the noise reduction factor and extracted from the fit of the measured value of R. In particular, in the case of an ideal transmission channel, in which the signal is encoded in a single-mode thermal state with µ TH = 1 superimposed to the portion of TWB, the expression in Eq. (7) modifies as where t quantifies the balancing between signal and idler arms. According to this expression, the condition R < 1 is satisfied only if the mean value of the single-mode thermal noise is properly limited, namely In the communication protocol, the two mean values of the thermal noise are chosen so that in both cases the nonclassicality condition is satisfied. The value of the bit of information can be extracted from the noise reduction factor, which is much more sensitive than the statistics, as better shown in the next Sections.
In the case of an eavesdropper's attack, the expression of R is modified. Indeed, in order to intercept the message, Eve can pick up part of the signal transmitted to Bob and thus evaluate the nonclassicality level as In the meanwhile, Bob will measure To cover the effect of the attack, Eve superimposes to the light signal sent to Bob a thermal noise having the same mean value of the subtracted light, namely t(�m� + �m TH �) . Thus, Bob measures www.nature.com/scientificreports/ Note that the successful implementation of the protocol relies on the value of t, which quantifies the amount of signal subtracted to Bob. If this value is small enough, Bob can still reveal sub-shot-noise correlations and also estimate the binary message encoded in the thermal noise by Alice, while Eve is not able to obtain enough information from the data, neither by evaluating the statistics nor by comparing the noise reduction factor. In addition, measured values of R larger than 1 must be interpreted as the result of an Eve's attack, thus suggesting the interruption of the communication. We also notice that Bob can use a portion of the dataset to extract the value of t by performing a fitting procedure according to Eq. (13). This allows him to understand if an eavesdropper's attack has occurred.
A realistic example. As described in the previous Section, to perform the protocol, Alice sends to Bob the message encrypted in the thermal noise superimposed to Bob's TWB part, repeated in short sequences. The length of the sequences represents an important parameter to control. In fact, if the sequence is long enough, the message can be decoded by simply recontructing the statistics of light, so that the strategy would not be safe since an eavesdropper could intercept the communication and also modify it.
To better emphasize this point, in the four panels of Fig. 2 we show the photon-number distributions of the light states given by a portion of TWB superimposed to a single-mode thermal state. The red surface corresponds to the thermal state with higher mean value, while the blue surface to the thermal state with lower mean value. In panel (a) the reconstruction has been obtained from 100 shots, in panel (b) from 1000 shots, in panel (c) from 10,000 shots, and in panel (d) from 100,000 shots. As it can be easily noticed, the mean value of the distributions changes according to the number of shots. In particular, in case (a) its evaluation is completely wrong since m H < m L , and the reconstructed distribution of detected photons is not correct.
To better investigate the minimum number of data needed to properly discriminate the states, in Fig. 3 we show their mean values as a function of the number of shots. It clearly emerges that the determination of the mean value is noisy only for a number of pulses less than 1000, while, for larger values, the discrimination between the two thermal-noise values is easy. The same conclusion can be obtained by evaluating the difference between the mean value of the state calculated over N shots and that corresponding to 100,000 shots. In Fig. 4 the data corresponding to the higher mean value are shown in black, and those corresponding to the lower mean value are in red. Also this representation proves that sequences shorter than 1000 pulses do not allow for a perfect To decript the message encoded in the two single-mode thermal states, Bob measures the shot-by-shot number of photons and evaluates the noise reduction factor using Alice's measurements of her part of the TWB, which he must receive separately. Indeed, the calculation of the noise reduction factor makes it possible to distinguish between the two signals even if an eavesdropper intercepts the message and introduces a noise source with the same mean value as the subtracted signal. On the contrary, in that case the mean value is useless to decrypt the message. Also in the case or R, it is crucial to investigate which is the minimum number of shots necessary to properly discriminate the two signals. To this aim, in Fig. 5 we plot the variance of R as a function of the number of pulses, N. The data are shown as dots, while the fitting function y = a/x , a being a positive constant, is shown as magenta curve. The two panels correspond to the different mean values of the employed optical states. The two   www.nature.com/scientificreports/ curves allow us to set a threshold on the minimum number of shots necessary to decrypt the message. The same result can be achieved by considering the noise reduction factor for the two states as a function of the number of shots (see Fig. 6). We can clearly see that for values of N smaller than 1000 the error in the determination of R is comparable to the difference between the mean values of the two thermal noise signals. These results prove that, in the absence of attacks, using either the mean value or the noise reduction factor is a good strategy to discriminate which signal has been sent.

Discussion
According to the model presented in the previous Section, here we consider the case in which the sequence of data is intercepted by Eve. In this situation, part of the signal is subtracted by the eavesdropper, thus introducing a loss, and at the same time a new signal is inserted in the communication channel. This new signal, whose mean value is equal to that of the subtracted amount, can be either a thermal signal or a coherent one. For instance, let us assume that it is a single-mode thermal state. We consider a TWB state having mean value equal to �m� = 2 and µ = 100 and two single-mode thermal states encoding the message with mean values �m H � = 0.3 and �m H � = 0.1 , respectively.
In Fig. 7 we show the theoretical behavior of the noise reduction factor measured by Bob as a function of the transmittance coefficient of the signal subtracted by Eve. We notice that for Bob it is always possible to discriminate the two states (black and red curves) with the difference between them becoming larger at increasing values of t. However, it is important to remark that non all values of t are fine for a successfull communication since for t > t * = 0.31 the values of R are larger than 1. For completeness, in Fig. 8 we also show Eve's counterpart. The main difference is that Eve is not able to properly discriminate the two signals if the transmission coefficient is too small. We compare the results obtained by Bob and Eve in the same graph to better appreciate Bob's advantage with respect to Eve in the discrimination process. The direct comparison is shown in Fig. 9, where the relative difference between the noise reduction factor in the two cases is evaluated for three different choices of mean values. Note that also in this case the results are shown as a function of the transmittance coefficient of the signal subtracted by Eve over the entire range [0, 1]. However, for a secure communication we must focus on the values of t smaller than t * . Moreover, we can clearly notice that in all cases Bob can discriminate the two signal better than Eve and that the larger the difference between the two mean values the easier the discrimination. Keeping this difference small is also useful to decrease the message leakage rate. This is particularly evident in the region Figure 6. Noise reduction factor as a function of the number of shots in the case of the higher mean value (black dots) and of the lower mean value (red dots).

Figure 7.
Noise reduction factor measured by Bob as a function of the transmittance efficiency t in the case of the higher mean value (black curve) and of the lower mean value (red curve). The quantum efficiency η is set equal to 0.2, which is the typical value obtained with HPDs. The horizontal gray line at R = 1 represents the boundary between classical and nonclassical correlations. The vertical line corresponds to t = t * , that is the threshold value over which Bob measures R > 1.

Conclusions
In this paper, we developed a novel protocol based on mesoscopic TWB states in order to send a binary message encoded in two single-mode thermal states with different mean values. Such thermal states are alternately superimposed to the portion of TWB generated by Alice and sent to Bob. While in the ideal case, namely in the absence of an eavesdropper's attack, the state actually sent can be easily retrieved from the measurement of the mean value or from the reconstruction of the photon-number distribution, the situation is more complex in the presence of loss and noise in the communication channel. In the considered case, Eve subtracts part of the signal and substitutes it with a thermal noise source having the same mean value as that of the subtracted light. Under this condition, the evaluation of the mean value is useless, while the calculation of the noise reduction factor for detected photons can be used to decode the message, since it gives the possibility to extract information about the signals superimposed to TWB. In the work we have also discussed the minimum length the sequence of thermal state signal with a given mean value should have in order to allow a successful discrimination process. The proof of principle shown in the paper was obtained with HPD detectors, but for the practical implementation of the protocol we intend to use a different class of photon-number-resolving detectors, namely Silicon photomultipliers 27,28 . Indeed, such detectors have a very good dynamic range suitable to employ more populated states and to make the difference between the TWB and the thermal state signals larger. In such a way, we can preserve nonclassicality for larger values of the transmission efficiency with which Eve subtracts part of the signal, and we can make the state discrimination operated by Bob more successful. Moreover, it could be also useful to investigate the possibility to exploit different nonclassicality criteria that could be more sensitive to loss, such as that based on the second-order field photon-number moments 21,22,29 .

Methods
In order to investigate the feasibility of the protocol, we consider a multi-mode TWB state produced by parametric downconversion in a β-Barium-Borate crystal pumped by the fourth harmonics of a Nd:YLF laser regeneratively amplified at 500 Hz. Two portions at frequency degeneracy (523 nm) are spatially and spectrally selected, focused into two multi-mode fibers having 600-µ m core diameter and delivered to two hybrid photodetectors. A single-mode thermal state is produced by sending the second harmonics of the laser to a rotating ground glass disk and selecting a single speckle. A half wave-plate followed by a polarizing cube beam splitter placed on the pathway is used to change the energy of the thermal state and switch from one mean value to the other. The thermal field is superimposed to one portion of TWB and detected together with it. The two detector outputs are amplified, synchronously integrated by two boxcar-gated integrators and acquired. The energy of the pump field is changed in steps by means of a half-wave plate followed by a polarizing cube beam splitter. For each mean value of the pump, 100,000 acquisitions are recorded. By exploiting the self-consistent method extensively explained in 30 , each output of the detection chain, expressed in voltages, can be converted in number of detected photons. The strategy allows us to reconstruct the statistics of light and to calculate all the relevant quantities to characterize the optical states.

Data availability
The datasets generated during and/or analysed during the current study are available from the corresponding author on reasonable request.